chore: remove binary signing feature

- remove GPGFRONTEND_SIGN_BUILT_BINARY option from cmake
- remove signing logic from build workflows
- remove key generation and signing code
- remove related resource file generation

Author: saturneric

.github/workflows/release-qt5.yml

@@ -157,7 +157,6 @@ jobs:
           mkdir build && cd build
           cmake -G Ninja -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
             -DGPGFRONTEND_QT5_BUILD=ON \
-            -DGPGFRONTEND_SIGN_BUILT_BINARY=ON \
             -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON \
             ..
           cmake --build . --config ${{env.BUILD_TYPE}}  -- -j 4

.github/workflows/release.yml

@@ -304,7 +304,6 @@ jobs:
           cd $(cygpath -u "${{github.workspace}}")
           mkdir build && cd build
           cmake -G Ninja -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
-            -DGPGFRONTEND_SIGN_BUILT_BINARY=ON \
             -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON \
             ..
           cmake --build . --config ${{env.BUILD_TYPE}}  -- -j 4

.github/workflows/testing-nightly.yml

@@ -298,7 +298,6 @@ jobs:
           cd $(cygpath -u "${{github.workspace}}")
           mkdir build && cd build
           cmake -G Ninja -DCMAKE_BUILD_TYPE=${{env.BUILD_TYPE}} \
-            -DGPGFRONTEND_SIGN_BUILT_BINARY=ON \
             -DGPGFRONTEND_LINK_GPGME_INTO_CORE=ON \
             ..
           cmake --build . --config ${{env.BUILD_TYPE}}  -- -j 4

CMakeLists.txt

@@ -70,7 +70,6 @@ option(GPGFRONTEND_XCODE_ENABLE_SANDBOX "Enable SandBox For Xcode Build" OFF)
 
 # check options
 option(GPGFRONTEND_CHECK_RELEASE_COMMIT_HASH "Enable checking on commit hash from the GitHub release" OFF)
-option(GPGFRONTEND_SIGN_BUILT_BINARY "Use OpenSSL to sign shared libraries and executables" OFF)
 option(GPGFRONTEND_LINK_GPGME_INTO_CORE "Statically link GpgME into the core library" OFF)
 option(GPGFRONTEND_LINK_OPENSSL_INTO_EXEC "Statically link OpenSSL into the executable" OFF)
 
@@ -109,12 +108,6 @@ else()
   set(BUILD_STRIP_RPATH 0)
 endif()
 
-if(GPGFRONTEND_SIGN_BUILT_BINARY)
-  set(SIGN_BUILT_BINARY 1)
-else()
-  set(SIGN_BUILT_BINARY 0)
-endif()
-
 if(GPGFRONTEND_LINK_GPGME_INTO_CORE)
   set(BUILD_AND_STATIC_LINK_GPGME 1)
 else()
@@ -435,41 +428,6 @@ else()
   endif()
 endif()
 
-if(SIGN_BUILT_BINARY)
-  set(SIGN_KEYS_DIR "${CMAKE_BINARY_DIR}/keys")
-  file(MAKE_DIRECTORY "${SIGN_KEYS_DIR}")
-
-  set(SIGN_PRIVATE_KEY "${SIGN_KEYS_DIR}/private.pem")
-  set(SIGN_PUBLIC_KEY "${SIGN_KEYS_DIR}/public.pem")
-
-  find_program(OPENSSL_EXECUTABLE NAMES openssl)
-
-  if(NOT OPENSSL_EXECUTABLE)
-    message(FATAL_ERROR "Signing is enabled (SIGN_BUILT_BINARY=ON), but openssl executable not found, please install OpenSSL.")
-  endif()
-
-  execute_process(
-    COMMAND ${OPENSSL_EXECUTABLE} genpkey -algorithm RSA -pkeyopt rsa_keygen_bits:2048 -out "${SIGN_PRIVATE_KEY}"
-    RESULT_VARIABLE result_priv
-  )
-
-  if(NOT result_priv EQUAL 0)
-    message(FATAL_ERROR "Failed to generate private key for binary signing.")
-  endif()
-
-  execute_process(
-    COMMAND ${OPENSSL_EXECUTABLE} pkey -in "${SIGN_PRIVATE_KEY}" -pubout -out "${SIGN_PUBLIC_KEY}"
-    RESULT_VARIABLE result_pub
-  )
-
-  if(NOT result_pub EQUAL 0)
-    message(FATAL_ERROR "Failed to generate public key for binary signing.")
-  endif()
-
-  message(STATUS "Binary Signing Private Key: ${SIGN_PRIVATE_KEY}")
-  message(STATUS "Binary Signing Public Key: ${SIGN_PUBLIC_KEY}")
-endif()
-
 if(BUILD_AND_STATIC_LINK_GPGME)
   add_subdirectory(third_party)
 endif()

cmake/LibraryRegistry.cmake

@@ -35,14 +35,6 @@ function(register_library name out_var)
   set_target_properties(${target_name} PROPERTIES
     VERSION ${PROJECT_VERSION})
 
-  if(SIGN_BUILT_BINARY)
-    add_custom_command(TARGET ${target_name} POST_BUILD
-      COMMAND ${OPENSSL_EXECUTABLE} dgst -sha256 -sign "${SIGN_PRIVATE_KEY}"
-      -out "$<TARGET_FILE:${target_name}>.sig" "$<TARGET_FILE:${target_name}>"
-      VERBATIM
-    )
-  endif()
-
   set_target_properties(${target_name} PROPERTIES
     POSITION_INDEPENDENT_CODE ON
     CXX_VISIBILITY_PRESET hidden

cmake/ModuleRegistry.cmake

@@ -34,14 +34,6 @@ function(register_module name out_var)
 
   set_target_properties(${target_name} PROPERTIES POSITION_INDEPENDENT_CODE ON)
 
-  if(SIGN_BUILT_BINARY)
-    add_custom_command(TARGET ${target_name} POST_BUILD
-      COMMAND ${OPENSSL_EXECUTABLE} dgst -sha256 -sign "${SIGN_PRIVATE_KEY}"
-      -out "$<TARGET_FILE:${target_name}>.sig" "$<TARGET_FILE:${target_name}>"
-      VERBATIM
-    )
-  endif()
-
   target_compile_features(${target_name} PRIVATE cxx_std_17)
 
   target_link_libraries(${target_name} PRIVATE gf_sdk)

src/CMakeLists.txt

@@ -321,41 +321,6 @@ if(MINGW)
   endforeach()
 endif()
 
-if(SIGN_BUILT_BINARY)
-  if(GPGFRONTEND_QT5_BUILD)
-    set(KEYS_QRC_FILE "${CMAKE_CURRENT_BINARY_DIR}/keys_resources.qrc")
-
-    file(WRITE ${KEYS_QRC_FILE}
-      "<!DOCTYPE RCC>\n"
-      "<RCC version=\"1.0\">\n"
-      "  <qresource prefix=\"/keys\">\n"
-    )
-
-    foreach(PUBKEY_FILE ${SIGN_PUBLIC_KEY})
-      get_filename_component(PUBKEY_FILENAME ${PUBKEY_FILE} NAME)
-      file(APPEND ${KEYS_QRC_FILE}
-        "    <file alias=\"${PUBKEY_FILENAME}\">${PUBKEY_FILE}</file>\n"
-      )
-    endforeach()
-
-    file(APPEND ${KEYS_QRC_FILE}
-      "  </qresource>\n"
-      "</RCC>\n"
-    )
-
-    qt5_add_resources(KEYS_RESOURCES ${KEYS_QRC_FILE})
-
-    target_sources(${APP_NAME} PRIVATE ${KEYS_RESOURCES})
-
-  else()
-    qt_add_resources(${APP_NAME} "binaryvalidation"
-      PREFIX "/keys"
-      BASE "${CMAKE_BINARY_DIR}/keys"
-      FILES ${SIGN_PUBLIC_KEY}
-    )
-  endif()
-endif()
-
 # link options for GpgFrontend
 target_link_libraries(${APP_NAME} gf_core gf_ui gf_test)